initial commit

roles/identity_ad/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart sssd
+  ansible.builtin.systemd:
+    name: sssd
+    state: restarted

roles/identity_ad/tasks/main.yml

@@ -0,0 +1,89 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [identity_ad, always]
+
+- name: Install AD integration packages
+  ansible.builtin.package:
+    name: "{{ identity_ad_packages }}"
+    state: present
+  tags: [identity_ad]
+
+- name: Check whether host is already domain-joined
+  ansible.builtin.command: realm list
+  register: identity_ad_realm_status
+  changed_when: false
+  failed_when: false
+  tags: [identity_ad]
+
+- name: Join Active Directory domain
+  ansible.builtin.command: >
+    realm join --user={{ ad_join_username }}
+    --computer-ou="{{ ad_ou }}"
+    {{ ad_domain }}
+  args:
+    stdin: "{{ ad_join_password }}"
+  when: ad_domain not in identity_ad_realm_status.stdout
+  changed_when: true
+  no_log: true
+  tags: [identity_ad]
+
+- name: Deploy sssd.conf
+  ansible.builtin.template:
+    src: sssd.conf.j2
+    dest: /etc/sssd/sssd.conf
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart sssd
+  tags: [identity_ad]
+
+- name: Enable oddjobd (required for pam_mkhomedir, RedHat family)
+  ansible.builtin.systemd:
+    name: oddjobd
+    enabled: true
+    state: started
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [identity_ad]
+
+- name: Enable automatic home directory creation (RedHat family)
+  ansible.builtin.command: authselect enable-feature with-mkhomedir
+  register: identity_ad_authselect_result
+  changed_when: "'already enabled' not in identity_ad_authselect_result.stderr"
+  failed_when: false
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [identity_ad]
+
+- name: Check whether pam_mkhomedir is already enabled (Debian family)
+  ansible.builtin.command: grep -q pam_mkhomedir.so /etc/pam.d/common-session
+  register: identity_ad_mkhomedir_check
+  changed_when: false
+  failed_when: false
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [identity_ad]
+
+- name: Enable automatic home directory creation (Debian family)
+  ansible.builtin.command: pam-auth-update --enable mkhomedir
+  when:
+    - ansible_facts['os_family'] == "Debian"
+    - identity_ad_mkhomedir_check.rc != 0
+  changed_when: true
+  tags: [identity_ad]
+
+- name: Enable and start sssd
+  ansible.builtin.systemd:
+    name: sssd
+    enabled: true
+    state: started
+  tags: [identity_ad]
+
+- name: Restrict login access to authorized AD groups
+  ansible.builtin.lineinfile:
+    path: /etc/sssd/sssd.conf
+    regexp: "^access_provider"
+    line: "access_provider = simple"
+  notify: restart sssd
+  tags: [identity_ad]

roles/identity_ad/templates/sssd.conf.j2

@@ -0,0 +1,23 @@
+# {{ ansible_managed }}
+[sssd]
+services = nss, pam
+domains = {{ ad_domain }}
+
+[domain/{{ ad_domain }}]
+id_provider = ad
+access_provider = simple
+simple_allow_groups = {{ ad_admin_group }}, {{ ad_operator_group }}
+auth_provider = ad
+chpass_provider = ad
+
+ad_domain = {{ ad_domain }}
+krb5_realm = {{ ad_domain_realm }}
+
+use_fully_qualified_names = {{ sssd_use_fully_qualified_names | lower }}
+fallback_homedir = /home/%d/%u
+default_shell = /bin/bash
+
+cache_credentials = true
+enumerate = false
+
+ldap_id_mapping = true

roles/identity_ad/vars/Debian.yml

@@ -0,0 +1,10 @@
+---
+identity_ad_packages:
+  - realmd
+  - sssd
+  - sssd-tools
+  - adcli
+  - samba-common-bin
+  - krb5-user
+  - libnss-sss
+  - libpam-sss

roles/identity_ad/vars/RedHat.yml

@@ -0,0 +1,10 @@
+---
+identity_ad_packages:
+  - realmd
+  - sssd
+  - sssd-tools
+  - oddjob
+  - oddjob-mkhomedir
+  - adcli
+  - samba-common-tools
+  - krb5-workstation